Amazon Web Services wants to cut the pile of scanner alerts down to the ones an attacker could actually use. AWS Continuum for code vulnerabilities, now generally available, takes findings from across a customer’s environment, checks which ones are exploitable, ranks them by business impact and opens a pull request with a proposed fix for each.
The service went live Thursday afternoon in the US East (N. Virginia) and US West (Oregon) regions. In the launch post, AWS’s Esra Kayabali framed it as a response to speed on the attacker’s side: “Using frontier artificial intelligence (AI) models, threat actors can turn a vulnerability disclosure into working exploit code in minutes,” she wrote, and the same tools that speed up development also add to the findings security teams have to work through.
Reachability decides the ranking
Continuum builds what AWS calls a context graph from two places, the customer’s code repositories and its AWS environment. Code comes in through a GitHub integration or an Amazon S3 bucket. On the AWS side, a collector installed in the account and region where the code runs gathers AWS Config resources and network configuration, so the service can tell whether a vulnerable path is reachable over the network and what an attacker could get to from it.
From that graph it works out which systems are business-critical, such as customer data stores, payment pipelines and authentication services, then ranks each issue by how close its attack path runs to them. AWS’s point is that a generic severity score treats a critical bug in a dev-only utility the same as a medium one sitting a step away from a payments database.
Each finding gets an evidence level. When Continuum can reproduce a bug, it runs the exploit in an isolated sandbox and attaches proof-of-concept code and reproduction steps to the issue, along with the attack path and a blast radius assessment.
A person still clicks merge
Fixes arrive as a code patch, a dependency upgrade or a configuration change, and every one needs human approval. In AWS’s walkthrough, a high-severity issue in a cart service was rated exploitable, reachable without authentication or user interaction, and came with a pull request titled “Continuum fix” that changed four files, adding 50 lines and removing 24. The console states plainly that a generated patch doesn’t mean the issue is fixed.
Patches that fail to hold are a growing problem: Terra Security found that the share of GitHub security fixes needing a follow-up advisory for a failed patch within 90 days rose from about 0.2% over 2019 through 2025 to 2.3% this year, as WebProNews reported Tuesday. AWS says customers will later be able to let Continuum apply certain classes of fixes on its own once confidence gates pass, including test coverage, scope bounds and historical success rate.
Pricing has two parts, according to the Continuum pricing page: a monthly context fee based on the lines of code the service protects, and a usage-based inference fee for the security work it performs. There are no upfront costs or minimums. AWS picks among several frontier cyber models for each task, so customers don’t have to buy model access themselves. Sandra Yi, Cyber Program Office Lead at Infor, said in a testimonial on the product page that Continuum “handles the cost and complexity of running them, without a platform to build or maintain.”
The code product joins Continuum for penetration testing, the service formerly called AWS Security Agent. On Oct. 5, AWS put continuous penetration testing inside CI/CD pipelines into public preview, with findings delivered straight into pipeline output. IBM sells a related service. Its X-Force Advanced Proactive Security, which WebProNews covered Tuesday, uses frontier models in penetration testing but keeps IBM’s X-Force testers in charge of the work.